Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bot Benefits #149

Open
DadeKuma opened this issue Feb 29, 2024 · 4 comments
Open

Bot Benefits #149

DadeKuma opened this issue Feb 29, 2024 · 4 comments

Comments

@DadeKuma
Copy link

Main issue.

This issue should list every benefit caused by bot races, and it's a reference to this comment:

What would be extremely helpful is to see two new issues started and linked to this one:

  1. Bot problems
  2. Bot benefits
    Both should be focused as much as possible on brief statements of facts and evidence, minimizing duplicate comments as much as practical.

Then we will have something useful from which to proceed.

Problems should be listed in this other issue instead.

I recommend using this format to list every benefit:

### Benefits
- 1st Benefit
- 2nd Benefit
- 3rd Benefit
@DadeKuma
Copy link
Author

Benefits

  • H/M pot on the main contest is less diluted: imagine that you find a solo M, but you forgot to check for an EIP edge case that can be found automatically, which is also submitted by a few bots: now your solo M is worth way less.
  • QAs on the main contest are easier to judge: suppose that bot races get removed. Now every bot will compete in the contest QA, which is way worse as there isn't a 20-spot cap for bots. So an unlimited amount of bots/reports will flood the QA, making it way harder to judge

@IllIllI000
Copy link

Benefits

  • Higher-impact QA/Gas findings for the final report: For Gas/QA reports, not just quality matters, but quantity as well. If there is no bot race, it's not worth while time/pay-wise for a warden to submit a single high-impact Low, because they will be scored lower than an automated report that has smaller-impact findings, but a lot more of them. When a warden doesn't submit a finding, the sponsor misses out on this value that the QA/Gas reports are supposed to provide. The bots will find the most straight-forward-to-identify issues, which means that one or two high-impact Lows/large gas savings could now be worth while to submit as a QA/Gas report.

@ezcodeslide
Copy link

Benefits

  • Rewarding the development of smart contract static analysis tools benefits the web3 community as a whole. Bot races spur developer interest in web3 security, causing them to learn about the industry and invest time and effort into the development of tools that can increase security of web3 projects. Manual review and analysis is a powerful way to identify security vulnerabilities in a project, but automated tools can more quickly and easily identify simpler issues, allowing security researchers to focus on more impactful findings. The more developers involved in smart contracts, Ethereum, Solidity, etc., the better for everyone in the long run.
  • The primary focus of a contest is to increase the security of a project, but bots provide a valuable service by easily and quickly identifying minor code/security/usability/gas/maintainability improvements that the authors may not have thought of. Producing these reports in an automated manner likely eliminates many hours of manual labor by other wardens trying to identify them and from judges evaluating them in warden reports.

@ChaseTheLight01
Copy link

Benefits

  • As bot reports are published within 24 hrs of the contest. They can be used by wardens to identify higher severity vulnerabilities. This has already been proven to be the case as a very common question received is (I'm paraphrasing here) "if a issue an issue is reported within the bot report but I can prove a higher impact can I submit it." The answer given is usually yes from what I've seen. It is also commonly known that a high severity is often a combination of Low and Medium findings. Bots are great at providing these "weak points" for wardens to look into.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants